Portable web browser forensics: A forensic examination of the privacy benefits of portable web browsers

Abstract

Portable web browsers are installed on removable storage devices which can be taken by a user from computer to computer. One of the claimed benefits of portable web browsers is enhanced privacy, through minimization of the traces of browsing activity left on the host's hard disk. On the basis of this claim, it would appear that portable web browsers pose a challenge to forensic examiners trying to reconstruct past web browsing activity in the context of a digital investigation. The research examines one popular portable web browser, Google Chrome in both normal and private browsing mode, and compares the forensic traces of its use to forensic traces of the installed version of the same browser. The results show that Google Chrome Portable leaves traces of web browsing activity on the host computer's hard disk, and demonstrate a need for forensic testing of the privacy claims made for the use of portable web browsers.